IN THE CLAIMS 

Please cancel claims 1-39 without prejudice or disclaimer. Please add new claims 40- 
78 as indicated herein. All pending claims and their present status are reproduced below. No 
amendment to the claims is made herein. 
1-39. (Canceled) 

40. (New) A network monitoring system, comprising: 

a flow processor coupled to the media module, the flow processor classifying the 
collected data as a priority flow or a non-priority flow and collecting data associated with 
traffic on a network segment; 

a capture buffer coupled to the flow processor, the capture buffer including a priority 
queue and a non-priority queue; 

an allocation module coupled to the flow processor and the capture buffer, responsive 
to the flow processor classifying the collected data as a priority flow, the buffer allocation 
module storing the collected data in the priority queue and responsive to the flow processor 
classifying the collected data as a non-priority flow, the allocation module storing the 
collected data in the non-priority buffer, wherein the allocation module dynamically modifies 
a size of the priority queue responsive to classification of collected data as a priority flow by 
the flow processor. 

41 . (New) The network monitoring system of claim 40, wherein the allocation module 
dynamically decreases a size of the non-priority queue and increases a size of the priority 
queue responsive to classification of collected data as a priority flow. 
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42. (New) The network monitoring system of claim 40, wherein the buffer allocation 
module determines a number of priority flows and increases a size of the priority queue as 
the number of priority flows increases. 

43 . (New) The network monitoring system of claim 42, wherein the allocation module 
reallocates space from the non-priority queue to the priority queue to increase the size of the 
priority buffer. 

44. (New) The network monitoring system of claim 40, wherein the allocation module 
dynamically decreases a size of the priority queue and increases a size of the non-priority 
queue responsive to classification of collected data as a non-priority flow. 

45. (New) The network monitoring system of claim 44, wherein the allocation module 
reallocates space from the priority queue to the non-priority queue to increase the size of the 
non-priority buffer. 

46. (New) The network monitoring system of claim 40, wherein the flow processor 
monitors the average size of the priority queue and, responsive to the average size of the 
priority queue exceeding a threshold reclassifying data in the priority queue as a non-priority 
flow. 

47. (New) The network monitoring system of claim 40, wherein the flow processor 
includes a priority filter including one or more data attributes associated with the priority 
flow. 

48. (New) The network monitoring system of claim 40, further comprising an expert 
system coupled to the flow processor and the capture buffer, the expert system regulating 
data transmission from the capture buffer responsive to classification by the flow processor. 
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49. (New) The network monitoring system of claim 48, wherein regulating data 
transmission from the capture buffer responsive to classification by the flow processor 
comprises: 

transmitting data from the priority queue before transmitting data from the non- 
priority queue. 

50. (New) The network monitoring system of claim 40, wherein the flow processor 
classifies the collected data as the priority flow responsive to the flow processor determining 
the collected data is associated with a priority application type. 

5 1 . (New) The network monitoring system of claim 40, wherein the flow processor 
classifies the collected data as a priority flow or a non-priority flow by analyzing fields 
included in one or more packets included in the collected data. 

52. (New) The network monitoring system of claim 5 1 , wherein the fields included in 
one or more packets comprise: a prepended descriptor, a data link control header, a level 3 
header or one or more higher-level headers 

53. (New) The network monitoring system of claim 40, wherein the flow processor 
further modifies a data filter associated with the flow processor responsive to classifying the 
collected data as a priority flow or a non-priority flow and collecting data associated with 
traffic on a network segment. 

54. (New) The network monitoring system of claim 40, wherein the allocation module 
further associates a timestamp indicating when the collected data was received by the flow 
processor with the collected data. 
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55. (New) The network monitoring system of claim 54, wherein the allocation module 
receives the timestamp from a system external to the network monitoring system. 

56. (New) A method for monitoring network traffic comprising: 
capturing data from a network segment; 

partitioning a buffer into a priority queue and a non-priority queue; 

associating the captured data with a priority flow or a non-priority flow; 

responsive to associating the captured data with a priority flow, storing the captured 
data in the priority buffer and dynamically modifying a storage capacity of the priority 
buffer; 

responsive to associating the captured data with a non-priority flow, storing the 
captured data in the non-priority queue and dynamically modifying a storage capacity of the 
non-priority buffer. 

57. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the priority queue comprises: 

reallocating storage capacity from the non-priority queue to the priority queue. 

58. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the non-priority queue comprises: 

reallocating storage capacity from the priority queue to the non-priority queue. 

59. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the priority queue comprises: 

determining a current amount of captured data associated with the priority flow; 
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comparing the current amount of captured data associated with the priority flow to a 
threshold value; and 

responsive to the current amount of captured data associated with the priority flow 
exceeding the threshold value, increasing the capacity of the priority queue. 

60. (New) The method of claim 56, wherein associating the captured data with the 
priority flow or the non-priority flow comprises: 

identifying a packet included in the captured data; 

analyzing one or more fields of the packet; and 

responsive to the analysis of the one or more fields of the packet, classifying the 
packet as a priority flow or a non-priority flow. 

61 . (New) The method of claim 60, wherein the one or more fields of the packet 
comprise: a prepended descriptor, a data link control header, a level 3 header or one or more 
higher-level headers. 

62. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the non-priority queue comprises: 

determining a current amount of captured data associated with the non-priority flow; 

comparing the current amount of captured data associated with the non-priority flow 
to a threshold value; and 

responsive to the current amount of captured data associated with the non-priority 
flow exceeding the threshold value, increasing the capacity of the non-priority queue. 



Case 09665 (Amendment G) 
U.S. Serial No. 10/043,501 



6 



24523/09665/DOCS/1953545.1 



63. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the priority queue comprises: 

determining an average amount of data in the priority queue; 

determining a current amount of data in the priority queue; and 

responsive to the current amount of data in the priority queue exceeding the average 
amount of data in the priority queue, reclassifying data in the priority queue as a non-priority 
flow. 

64. (New) The method of claim 56, wherein dynamically modifying the storage capacity 
of the priority queue comprises: 

determining an average amount of data in the priority queue; 

comparing the average amount of data in the priority queue to a threshold; and 

responsive to the current amount of data in the priority queue exceeding the threshold, 
reclassifying data in the priority queue as a non-priority flow. 

65. (New) The method of claim 56, wherein associating the captured data with the 
priority flow or the non-priority flow comprises: 

determining whether the data includes one or more attributes associated with the 
priority flow. 

66. (New) The method of claim 56, further comprising: 

transmitting data from the priority queue before transmitting data from the non- 
priority queue. 

67. (New) The method of claim 56, further comprising: 
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associating a timestamp with the collected data, wherein the timestamp is received 
from an external system. 

68. (New) A computer program product comprising a computer-readable medium having 
computer program instructions and data encoded thereon, the computer program instructions 
for executing the steps of: 

capturing data from a network segment; 

partitioning a buffer into a priority queue and a non-priority queue; 

associating the captured data with a priority flow or a non-priority flow; 

responsive to associating the captured data with a priority flow, storing the captured 
data in the priority buffer and dynamically modifying a storage capacity of the priority 
buffer; 

responsive to associating the captured data with a non-priority flow, storing the 
captured data in the non-priority queue and dynamically modifying a storage capacity of the 
non-priority buffer. 

69. (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the priority queue comprises: 

reallocating storage capacity from the non-priority queue to the priority queue. 

70. (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the non-priority queue comprises: 

reallocating storage capacity from the priority queue to the non-priority queue. 
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7 1 . (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the priority queue comprises: 

determining a current amount of captured data associated with the priority flow; 

comparing the current amount of captured data associated with the priority flow to a 
threshold value; and 

responsive to the current amount of captured data associated with the priority flow 
exceeding the threshold value, increasing the capacity of the priority queue. 

72. (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the non-priority queue comprises: 

determining a current amount of captured data associated with the non-priority flow; 

comparing the current amount of captured data associated with the non-priority flow 
to a threshold value; and 

responsive to the current amount of captured data associated with the non-priority 
flow exceeding the threshold value, increasing the capacity of the non-priority queue. 

73. (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the priority queue comprises: 

determining an average amount of data in the priority queue; 

determining a current amount of data in the priority queue; and 

responsive to the current amount of data in the priority queue exceeding the average 
amount of data in the priority queue, reclassifying data in the priority queue as a non-priority 
flow. 
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74. (New) The computer program product of claim 68, wherein dynamically modifying 
the storage capacity of the priority queue comprises: 

determining an average amount of data in the priority queue; 

comparing the average amount of data in the priority queue to a threshold; and 

responsive to the current amount of data in the priority queue exceeding the threshold, 
reclassifying data in the priority queue as a non-priority flow. 

75. (New) The computer program product of claim 68, wherein associating the captured 
data with the priority flow or the non-priority flow comprises: 

determining whether the data includes one or more attributes associated with the 
priority flow. 

76. (New) The computer program product of claim 68, further comprising: 

transmitting data from the priority queue before transmitting data from the non- 
priority queue. 

77. (New) A method for monitoring network traffic comprising: 
capturing data from a network segment; 

partitioning a buffer into a priority queue and a non-priority queue; 

associating the captured data with a priority flow or a non-priority flow; 

responsive to associating the captured data with a priority flow, comparing the 
captured data to a priority trigger; and 

responsive to the captured data matching the priority trigger, generating an alarm 
notifying a user of the priority trigger. 
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78. (New) The method of claim 77, further comprising: 

responsive to associating the captured data with a non-priority flow, comparing the 
captured data to a non-priority trigger; and 

responsive to the captured data matching the priority trigger, generating an alarm 
notifying a user of the non-priority trigger. 
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